WWebBuddyMarketplace
Sign in
Pages
Install and run

First admin and the Ops console

How the first platform admin is created (there are no default credentials), the roles in YourDesk, and what each screen of the Ops console does.

4 min readUpdated Oct 17, 2026Applies to YourDesk 1.0.0

On this page

YourDesk ships with no default admin account and no setup wizard. The first person to sign up on a fresh database becomes the administrator.

Creating the first admin

  1. Deploy, run the migrations and open the site.
  2. Go to /signup and create your account before you share the address with anyone.
  3. Finish the short onboarding. Your sidebar now has an Ops entry.

That first account is made both the owner of its own studio and the platform admin for the whole deployment. The rules behind it:

  • The first profile created on a database with no other (non-demo) profiles gets the platform-admin role.
  • The demo account (demo@yourdesk.app) never counts, so turning on demo mode cannot hand someone your install.
  • If a database ever has no platform admin at all, the next time anyone loads the app the earliest account with the studio-admin role (or failing that, the earliest account) is promoted.

Warning

Sign-up is open by default. On a public address, whoever signs up first becomes the platform admin. Sign up yourself right after the first deploy, then decide whether to close sign-up under Ops → Product → Access.

Adding or recovering an admin

  • From the console: Ops → Users → Grant Ops on the person's row. Revoke Ops removes it. You cannot revoke your own Ops role while you are the only platform admin.

  • From the database, if you have locked yourself out:

    SQL
    update profiles set platform_role = 'platform_admin' where email = 'you@example.com';

    With Docker Compose: docker compose exec db psql -U yourdesk -d yourdesk, then run the statement.

Roles

YourDesk has three separate ideas of "role":

Role Values What it controls
Platform role Platform admin, or none Access to the Ops console for the whole deployment
Studio seat Owner, or member Inside one studio: only the owner can invite or remove teammates and start or change the plan. Members can otherwise see and change everything in the studio.
House role Admin, or member Shown in Ops → Users and on the profile page, and used to pick a platform admin if none exists. It does not change what anyone can do in the app.

The Ops console

Platform admins open it from the Ops entry in the sidebar (/ops/overview). Everyone else is sent back to the dashboard.

Screen Path What it is for
Overview /ops/overview Totals (users, workspaces, projects, invoices, proposals, Agent runs, active paid subscriptions), the newest sign-ups, and warnings: maintenance message live, sign-up closed, a payment provider enabled without its secret, or Stripe enabled without a webhook secret.
Users /ops/users Search accounts; toggle the house role; Grant Ops or Revoke Ops; Disable or Enable. See Disabling an account.
Workspaces /ops/workspaces Every studio with its owner, seats, projects, invoices, plan and subscription status.
Product /ops/product Brand fields, sign-up open or closed, maintenance message, feature flags for the Agent, Mail, Portals, Signup and Discover. A feature switched off is hidden from the sidebar and refused by the server. Configuration lists what each setting does.
Plans /ops/plans The plans on the public /pricing page. See Selling it as SaaS.
Payments /ops/payments Stripe and PayPal keys, test or live mode, on or off.
System /ops/system Database mode, whether DATABASE_URL, BETTER_AUTH_SECRET and an xAI key are set, how many personal xAI keys exist and how many migrations are applied.
Activity /ops/activity The latest 80 admin and payment events: product and plan changes, payment-provider saves, user changes, checkouts and plan activations.

Disabling an account

Disable on a person's row in Ops → Users stops that account using the app:

  • it is signed out everywhere at once;
  • new sign-ins are refused with "This account has been disabled. Contact the site operator.", for email and password and for Google alike;
  • every server call it makes is refused, even from a browser that still holds a recent session.

Enable lets them sign in again. You cannot disable your own account.

Note

Disabling applies to that one person. If they own a studio, its teammates keep working on it, and its proposal, invoice and portal links keep working for clients. Their data stays in the database.

How customers get in

  • Email and password sign-up is open by default; passwords need at least 8 characters. Sign-in and sign-up attempts are limited to 10 per 15 minutes per visitor address.
  • "Continue with Google" appears when GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set. A Google sign-in with the same email as an existing password account is linked to it.
  • With Signup closed, new accounts are refused on every path, except someone holding a pending team invitation for that exact address (and the demo account, when demo mode is on).
  • Every new account gets its own studio. Joining someone else's studio is by invitation; see Team seats.

Not in this version

  • No password reset or password change screen, and no email verification. A user who forgets their password cannot reset it in the app. If Google sign-in is configured and their address is a Google account, signing in with Google reaches the same account.
  • No account or studio deletion from the interface.
  • No impersonation and no per-studio plan override in the console.
  • No system email. The app sends mail only through a mailbox a studio connects itself; see Client updates and mail.